Hacker Tools, Techniques, Exploits and Incident Handling: SEC504

The Klez worm is a mass-mailing worm that exploits a vulnerability to open an executable attachment even in Microsoft Outlook's preview pane. The Klez worm gathers email addresses from the entries of the default Windows Address Book (WAB).

Which of the following registry values can be used to identify this worm?

A. HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices

B. HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

C. HKEY_CURRENT_USER\Software\Microsoft\WAB\WAB4\Wab File Name = "file and pathname of the WAB file"

D. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

Which of the following are countermeasures to prevent unauthorized database access attacks? Each correct answer represents a complete solution. Choose all that apply.

A. Session encryption

B. Removing all stored procedures

C. Applying strong firewall rules

D. Input sanitization

You want to measure the number of heaps used and overflows occurred at a point in time. Which of the following commands will you run to activate the appropriate monitor?

A. UPDATE DBM CONFIGURATION USING DFT_MON_TABLE

B. UPDATE DBM CONFIGURATION DFT_MON_TIMESTAMP

C. UPDATE DBM CONFIGURATION USING DFT_MON_BUFPOOL

D. UPDATE DBM CONFIGURATION USING DFT_MON_SORT